WireGuard: next generation in-kernel modern VPN • Hacker News Board

Re: WireGuard: next generation in-kernel modern VPN

#131

Post by teddyh » Wed, Jun 29, 2016, 7:12 AM UTC

icebraining wrote: post #107

teddyh wrote: post #94

Note: This project, despite having the text of the GPL 2 in a file named “COPYING”, is not actually licenced under GPL 2. The actual copyright statement found in source files is “ Copyright 2015-2016 Jason A. Donenfeld . All Rights Reserved. ”. It does not reference the GPL. This means, legally, that nobody can do anything with it. If the author actually meant to licence it under the GPL 2, he should read and follow…

That may technically be true, but if the author was to sue anyone based on that argument, this project itself would be in violation of copyright law, since all the code seems to be distributed only as a Linux kernel module (with all files #including kernel headers and such) and so it actually has to be distributed under the GPLv2.

This is true, but I imagine that no company will actually use or distribute this project in any way, since it is actually illegal (however technically) for them to do so until this issue is resolved.

Re: WireGuard: next generation in-kernel modern VPN

#132

Post by Anonionman » Wed, Jun 29, 2016, 8:14 AM UTC

It would be useful to have option to connect to VPN server trough SOCKS/HTTP proxy like you can do with OpenVPN, and it is useful for traffic obfuscation and combining VPN with Tor/I2P. Another thing that I like is XOR patch for OpenVPN (https://github.com/clayface/openvpn_xorpatch), that can be very useful in hiding you are connecting to VPN.

Re: WireGuard: next generation in-kernel modern VPN

#133

Post by alainchabat » Wed, Jun 29, 2016, 8:53 AM UTC

vonnyfly wrote: post #122

Do you have try this in China internet? As we know, China has a more complicated network. UDP packets have a large loss. If it could work better than ocserv, this vpn will be a milestone.

same question here

Re: WireGuard: next generation in-kernel modern VPN

#134

Post by tristor » Wed, Jun 29, 2016, 9:03 AM UTC

hueving wrote: post #126

tptacek wrote: post #43

Earlier quoted context omitted.

Severe performance impact. Since we appear to be bolted to the top of the thread, I'll repeat a point I buried deeper in the thread: Maybe some readers of this thread are in the habit of casually bringing up random VPN connections between individual Linux machines. But in my experience, people tend to invest in VPN configurations so they can connect developers and ops to deployment environments and company networks.…

I was not concerned about it from a security perspective at all. What I'm concerned about is poor software engineering. The fact that something like a particular flavor of VPN needs to be integrated directly into the kernel smells to me like a shortcut to skip improving the kernel to enable better userland networking code. Why this VPN proto and not the next hot item of the month? How about we start throwing some loa…

> How about we start throwing some load balancing code directly into the kernel?

You mean like lvs/ipvs? [0]

> How about some TLS termination?

You mean like the KTLS project from Dave Watson/Facebook Engineering? [1][2]

[0] http://www.linuxvirtualserver.org/software/index.html

[1] https://github.com/ktls/af_ktls

[2] https://lwn.net/Articles/666509/

Re: WireGuard: next generation in-kernel modern VPN

#135

Post by janvidar » Wed, Jun 29, 2016, 9:05 AM UTC

cakoose wrote: post #75

zx2c4 wrote: post #37

Earlier quoted context omitted.

WireGuard is UDP only. For TCP or SSL tunneling, look at a million other things that already do this.

(I don't know much about networking.) What are the advantages of doing UDP instead of IP? It seems like, all else being equal, doing IP has the advantage of working with UDP and TCP out of the box.

UDP (and TCP) are built on top of IP. You can add other things on top of IP also, but they will be blocked by your average firewall.

Re: WireGuard: next generation in-kernel modern VPN

#136

Post by tinco » Wed, Jun 29, 2016, 9:08 AM UTC

zx2c4 wrote: post #69

steveklabnik wrote: post #62

Earlier quoted context omitted.

I am extremely excited to see the Rust version of this; how do I learn about it when it ships?

Join the mailing list! https://lists.zx2c4.com/mailman/listinfo/wireguard And if you're savvy and want to get involved with development, we need all the help we can find!

Why necessarily lower speed? Are you hinting at bounds checking? I would think that a rust implementation might have slightly more pressure on the CPU but would not effectively be slower. Am I wrong?

Re: WireGuard: next generation in-kernel modern VPN

#137

Post by nickpsecurity » Wed, Jun 29, 2016, 9:28 AM UTC

viraptor wrote: post #112

nickpsecurity wrote: post #87

Earlier quoted context omitted.

Wow. Talk about overlooking the obvious. Thanks lol...

Maybe most likely, but not necessarily obvious. While there's no popular module for kernel written in something else than C (as far as I know), there are known ways to write working non-C modules.

C was best assumption as 99+% chance it would be C. Yet, you are right in that I've seen device drivers for Linux done in Ada and ATS languages. It's why I usually don't assume but one was warranter here.

Re: WireGuard: next generation in-kernel modern VPN

#138

Post by steveklabnik » Wed, Jun 29, 2016, 10:21 AM UTC

tinco wrote: post #136

zx2c4 wrote: post #69

Earlier quoted context omitted.

Join the mailing list! https://lists.zx2c4.com/mailman/listinfo/wireguard And if you're savvy and want to get involved with development, we need all the help we can find!

Why necessarily lower speed? Are you hinting at bounds checking? I would think that a rust implementation might have slightly more pressure on the CPU but would not effectively be slower. Am I wrong?

I took it as "the Rust version is in userspace, and therefore will be slower than the in-kernel version."

Re: WireGuard: next generation in-kernel modern VPN

#139

Post by Asooka » Wed, Jun 29, 2016, 10:22 AM UTC

cakoose wrote: post #93

zx2c4 wrote: post #24

Earlier quoted context omitted.

As mentioned in the roadmap and the cross-platform page, we're working on a cross-platform userspace client, so Mac and Windows users can use it too. It's in the works!

This comment was marked 'dead', but I think it was a useful question (though maybe a little aggressive in its wording): > So what's the point ? Linux is a niche market. Mac & Windows will be the vast majority of your users and won't enjoy your killer kernel-based feature... Even when Windows/Mac are the vast majority of clients, each client only needs to process its own traffic. The VPN gateway is more likely the bot…

If the comment is marked 'dead', I think rather than answering someone whom we clearly don't want contributing to HN, you should re-ask the question in a civil and polite form and answer that. Otherwise, you're just enabling troll behaviour.

Re: WireGuard: next generation in-kernel modern VPN

#140

Post by tinco » Wed, Jun 29, 2016, 10:57 AM UTC

steveklabnik wrote: post #138

tinco wrote: post #136

Earlier quoted context omitted.

Why necessarily lower speed? Are you hinting at bounds checking? I would think that a rust implementation might have slightly more pressure on the CPU but would not effectively be slower. Am I wrong?

I took it as "the Rust version is in userspace, and therefore will be slower than the in-kernel version."

Right, I heard about the Rust kernel module[1], but perhaps its environment isn't friendly enough yet to attempt to port a project like this to?

edit: Just read a little bit of its source, apparently you have to disable std, and he replaces it with his own linux_std that at this point has only printf implemented. So yeah it'd be a pretty intense project if one would attempt it :)

1] https://github.com/tsgates/rust.ko